IgnisDa
CVE-2026-127086: Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId
CVE-2026-127086 Nov 13, 2026 Source: Vendor
In brief. IgnisDa published CVE-2026-127086: Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId on November 13, 2026. It credits 1 researcher or team for 1 CVE.
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-127086
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1